• Proceedings of the Korea Inteligent Information System Society Conference
• /
• 2007.11a
• /
• pp.514-519
• /
• 2007

컴퓨터 네트워크 모니터링에 의한 보안장비는 많은 트래픽 자료를 분석하여, 이상유무를 판단하고, 대응해야 한다. 기존의 보안장비들은 이미 알려진 패턴에 대한 규칙을 이용하는 오용탐지방법(misuse detection)과 의미를 파악하기 어려운 많은 자료들을 제시하고 있는데 머물고 있다. 보다 나은 보안을 위해서는 정상적인 동작에서 벗어나는 이상징후를 탐지하여 침입을 탐지하는 이상탐지방법(anomaly detection)의 채용이 필요하고, 보안장비에서 제시되는 많은 트래픽 자료들은 보안전문가의 전문적인 분석이 필요하다. 본 연구에서는 데이터마이닝 기법을 이용한 이상탐지방법과 보안전문가의 전문적인 보안지식에 의한 분석, 대응, 관리를 위한 지식처리 기법을 사용할 수 있는 지능형 IPS(intrusion Detection System) 프레임워크를 제안한다.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.07a
• /
• pp.121-125
• /
• 2003

In this paper, we propose a framework of Transmission Control Protocol with Software Rejuvenation methodology, which is applicable for network system survivability. This method is utilized to improve the survivability because it can limit the damage caused by successful attacks. The main objectives are to detect intrusions in real time, to characterize attacks, and to survive in face of attacks. To counter act the attacks' attempts or intrusions, we perform the Software Rejuvenation methods such as killing the intruders' processes in their tracks, halting abuse before it happens, shutting down unauthorized connection, and responding and restarting in real time. These slogans will really frustrate and deter the attacks, as the attacker can't make their progress. This is the way of survivability to maximize the deterrence against an attack in the target environment. We address a framework to model and analyze the critical intrusion tolerance problems ahead of intrusion detection on Transmission Control Protocol (TCP).

• Journal of Information Processing Systems
• /
• v.19 no.5
• /
• pp.688-701
• /
• 2023

The conventional methods of network intrusion detection system (NIDS) cannot measure the trend of intrusiondetection targets effectively, which lead to low detection accuracy. In this study, a NIDS method which based on a deep neural network in a big-data environment is proposed. Firstly, the entire framework of the NIDS model is constructed in two stages. Feature reduction and anomaly probability output are used at the core of the two stages. Subsequently, a convolutional neural network, which encompasses a down sampling layer and a characteristic extractor consist of a convolution layer, the correlation of inputs is realized by introducing bidirectional long short-term memory. Finally, after the convolution layer, a pooling layer is added to sample the required features according to different sampling rules, which promotes the overall performance of the NIDS model. The proposed NIDS method and three other methods are compared, and it is broken down under the conditions of the two databases through simulation experiments. The results demonstrate that the proposed model is superior to the other three methods of NIDS in two databases, in terms of precision, accuracy, F1- score, and recall, which are 91.64%, 93.35%, 92.25%, and 91.87%, respectively. The proposed algorithm is significant for improving the accuracy of NIDS.

• Proceedings of the Korean Information Science Society Conference
• /
• 2008.06a
• /
• pp.134-137
• /
• 2008

A novel Intrusion Detection and Response System (IDRS) for IP based Ubiquitous Sensor Networks (IP-USN) is proposed. According to the best of our knowledge this is the first security framework for any kind of IP based sensor devices. The proposed scheme is fast, lightweight in terms of computation and memory, which make it appropriate for resource constrained sensor devices.

• 제어로봇시스템학회:학술대회논문집
• /
• 2003.10a
• /
• pp.2174-2177
• /
• 2003

Internet is exposed to network attacks as Internet has a security weakness. Network attacks which are virus, system intrusion, and deny of service, put Internet in the risk of hacking, so the damage of public organization and banking facilities are more increased. So, it is necessary that the security technologies about intrusion detection and controlling attacks minimize the damage of hacking. Router is the network device of managing traffic between Internets or Intranets. The damage of router attack causes the problem of the entire network. The security technology about router is necessary to defend Internet against network attacks. Router has the need of access control and security skills that prevent from illegal attacks. We developed integrated security management framework for secure networking and kernel-level security engine that filters the network packets, detects the network intrusion, and reports the network intrusion. The security engine on the router protects router or gateway from the network attacks and provides secure networking environments. It manages the network with security policy and handles the network attacks dynamically.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.2
• /
• pp.99-106
• /
• 2003

Intrusions pose a serious security risk in a network environment. For detecting the intrusion effectively, many researches have developed data mining framework for constructing intrusion detection modules. Traditional anomaly detection techniques focus on detecting anomalies in new data after training on normal data. To detect anomalous behavior, Precise normal Pattern is necessary. This training data is typically expensive to produce. For this, the understanding of the characteristics of data on network is inevitable. In this paper, we propose to use clustering and association rules as the basis for guiding anomaly detection. For applying entropy to filter noisy data, we present a technique for detecting anomalies without training on normal data. We present dynamic transaction for generating more effectively detection patterns.

• Proceedings of the Korean Information Science Society Conference
• /
• 2003.04a
• /
• pp.410-412
• /
• 2003

공격이 다양해짐에 따라 침입탐지 기술기법에 관한 연구도 활발히 진행되고 있으나, 전반적인 연구 흐름에 관한 연구는 부족한 실정이다. 본 논문에서는 침입탐지 분야에서 오랜 기간 연구를 수행하여 대표적인 침입탐지시스템 프레임워크까지 제안한 세 그룹(SRI, UC Davis, Purdue)에서의 연구 내용을 분석했다. 그 결과 ‘The First IDS’. ‘Multi Target IDS’, ‘IDS Framework’, ‘IDS Framework Component and Application’의 4단계로 분류했으며, 이에 대한 각 그룹의 세부적인 연구 내용을 기술하고 각 기법들간의 발전 원인 및 전체적인 연구 방향을 살펴보고자 한다.

• Proceedings of the Korean Information Science Society Conference
• /
• 2004.04a
• /
• pp.250-252
• /
• 2004

네트워크 침입 탐지와 방어를 위한 연구는 실제 네트워크 환경을 구성하고, 실제 네트워크 침입을 통해 네트워크 침입 탐지와 방어 기법을 연구하는 것이 가장 좋은 방법이다. 하지만, 실제 네트워크 환경에서 대규모 네트워크를 구성하고 네트워크 침입을 시도하여, 침입이 네트워크에 미치는 영향과 침입을 탐지하고 방어하는 방법은 많은 시간과 비용이 필요하게 된다. 그 대안으로 제안하는 시뮬레이션을 통한 연구는 시간과 비용은 줄이면서, 실제와 근사한 결과를 얻을 수 있다. 본 논문에서 제안하는 시뮬레이션 프레임웍은 대규모 네트워크 환경을 구성하고, 구성한 네트워크 환경 위에서 특정한 호스트로 네트워크 침입을 시도할 때, 네트워크 침입을 탐지 및 방어하기 위한 적절한 방법을 연구하기 위한 프레임웍으로, 특정한 공격의 목표가 된 호스트상에 IDS(Intrusion Detection System)나 Firewall을 설치하고, 시뮬레이션의 진행 중 실험자가 원하는 시간에 공격을 잠시 중단시키고. 방어나 침입 탐지를 위한 IDS나 방화벽의 룰셋을 변경해 주는 방법을 통해 네트워크 침입 탐지 및 방어에 관한 유효 적절한 방법을 실험 할 수 있게 해 준다. 본 시뮬레이션 프레임웍을 사용하여, 이후 좀 더 다양한 네트워크 침입 구현을 통해 다양한 침입 행동에 대한 적절한 침입탐지 및 방어 기법에 관한 연구에 많은 도움이 될 것이다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.22 no.4
• /
• pp.869-882
• /
• 2012

With the growth of Web services and the development of web exploit toolkits, web-based malware has increased dramatically. Using Javascript Obfuscation, recent web-based malware hide a malicious URL and the exploit code. Thus, pattern matching for network intrusion detection systems has difficulty of detecting malware. Though various methods have proposed to detect Javascript malware on a users' web browser, the overall detection is needed to counter advanced attacks such as APTs(Advanced Persistent Treats), aimed at penetration into a certain an organization's intranet. To overcome the limitation of previous pattern matching for network intrusion detection systems, a novel deobfuscating method to handle obfuscated Javascript is needed. In this paper, we propose a framework for effective hidden malware detection through an automated deobfuscation regardless of advanced obfuscation techniques with overriding JavaScript functions and a separate JavaScript interpreter through to improve jsunpack-n.

• Journal of the Korea Society of Computer and Information
• /
• v.9 no.4 s.32
• /
• pp.157-165
• /
• 2004

The paper suggests that web-server security management system will be able to detect the web service attack accurately and swiftly which is keeping on increasing at the moment and reduce the possibility of the false positive detection. This system gathers the results of many unit security modules at the real time and enhances the correctness of the detection through the correlation analysis procedure. The unit security module consists of Network based Intrusion Detection System module. File Integrity Check module. System Log Analysis module, and Web Log Analysis and there is the Correlation Analysis module that analyzes the correlations on the spot as a result of each unit security module processing. The suggested system provides the feasible framework of the range extension of correlation analysis and the addition of unit security module, as well as the correctness of the attack detection. In addition, the attack detection system module among the suggested systems has the faster detection time by means of restructuring Snort with multi thread base system. WSM will be improved through shortening the processing time of many unit security modules with heavy traffic.